Description
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MariaDB | server | >= 11.4.1, < 11.4.10, >= 11.8.1, < 11.8.6, >= 12.1.2, < 12.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mariadb | 1:11.8.6-1 | — |
| Debian 13 | mariadb | 1:11.8.6-0+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | mariadb | No fix yet | — |
| Ubuntu 24.04 LTS | mariadb | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | galera | 26.4.25-1.el10_2 | RHSA-2026:19021 |
| RHEL 10 | mariadb11.8 +14 | 3:11.8.6-2.el10_2 | RHSA-2026:19021 |
| RHEL 9 | galera | 26.4.25-1.module+el9.8.0+24146+e179c349 | RHSA-2026:19182 |
| RHEL 9 | mariadb +14 | 3:11.8.6-2.module+el9.8.0+24146+e179c349 | RHSA-2026:19182 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | galera | 26.4.25-1.el10_2 | RLSA-2026:19021 |
| Rocky Linux 10 | mariadb11.8 | 3:11.8.6-2.el10_2 | RLSA-2026:19021 |
| Rocky Linux 9 | galera | 26.4.25-1.module+el9.8.0+40192+484cc2de | RLSA-2026:19182 |
| Rocky Linux 9 | mariadb | 3:11.8.6-2.module+el9.8.0+40192+484cc2de | RLSA-2026:19182 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | mariadb | 11.8.6-150700.3.12.1 | SUSE-SU-2026:1367-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mariadb | 11.8.6-1.1 | openSUSE-SU-2026:10694-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | galera | 26.4.25-1.el10_2 | ELSA-2026-19021 |
| Oracle Linux 10 | mariadb11.8 +14 | 3:11.8.6-2.el10_2 | ELSA-2026-19021 |
| Oracle Linux 9 | galera | 26.4.25-1.0.1.module+el9.8.0+90895+7148d2d3 | ELSA-2026-19182 |
| Oracle Linux 9 | mariadb +14 | 3:11.8.6-2.module+el9.8.0+90895+7148d2d3 | ELSA-2026-19182 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | mariadb-11.8 | 11.8.9-r1 | — |
| Wolfi rolling | mariadb-12.1 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
dinosn/CVE-2026-32710 ★ 16 · May 6, 2026
Heap OOB write in MariaDB JSON_SCHEMA_VALID() → persistent privilege escalation (lab-assisted)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- ELSA-2026-19021 Moderate: galera and mariadb11.8 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- RHSA-2026:19182 Red Hat Security Advisory: mariadb:11.8 security update Red Hat Security Advisories (RHSA) · Jul 5, 2026
- RHSA-2026:19021 Red Hat Security Advisory: galera and mariadb11.8 security update Red Hat Security Advisories (RHSA) · Jul 5, 2026
- WID-SEC-2026-0815 MariaDB: Schwachstelle ermöglicht Denial of Service und potenziell Codeausführung BSI CERT-Bund (WID) · Jun 22, 2026
- ELSA-2026-19182 Moderate: mariadb:11.8 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 15, 2026
- RLSA-2026:19021 Moderate: galera and mariadb11.8 security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19182 Moderate: mariadb:11.8 security update Rocky Linux Security Advisories · May 28, 2026
- openSUSE-SU-2026:10694-1 libmariadbd-devel-11.8.6-1.1 on GA media SUSE / openSUSE Security Updates · May 6, 2026
- SUSE-SU-2026:1367-1 Security update for mariadb SUSE / openSUSE Security Updates · Apr 16, 2026